ntwarden-windows-analysis-toolkit

# NtWarden Windows Analysis and Research Toolkit > Skill by [ara.so](https://ara.so) — Daily 2026 Skills collection. NtWarden is a Windows system inspection tool built on ImGui + DirectX 11. It covers processes, services, network, kernel internals, ETW, registry, object manager, and more — locally or remotely via WinSysServer. A kernel driver (KWinSys) enables deep kernel-mode analysis including SSDT hooks, kernel callbacks, EPT hook detection, and driver integrity checks. --- ## Architecture | Component | Role | |---|---| | **NtWarden** | GUI app (ImGui + DirectX 11) | | **WinSys** | Static lib — process, service, network enumeration | | **KWinSys** | Kernel driver — callbacks, SSDT, kernel modules, pool, etc. | | **WinSysServer** | Headless TCP server for remote inspection | --- ## Build Requirements - Visual Studio 2022 - Windows SDK 10.0.26100.0+ - WDK (Windows Driver Kit) — required only for KWinSys kernel driver --- ## Building ```powershell # Open solution in Visual Studio 2022 # Select Release | x64 # Build All # Output lands in: x64/Release/NtWarden.exe x64/Release/WinSysServer.exe x64/Release/KWinSys/KWinSys.sys ``` Solution structure: ``` NtWarden.sln ├── NtWarden/ # GUI application ├── WinSys/ # Core static library ├── KWinSys/ # Kernel driver (.sys) └── WinSysServer/ # Remote TCP server ``` --- ## Running NtWarden Always run as **Administrator** for full functionality. ```powershell # Run elevated Start-Process NtWarden.exe -Verb RunAs ``` User-mode features (processes, services, network, ETW, registry, object manager) work without the driver. --- ## Kernel Driver Setup (KWinSys) > ⚠️ Use only in a test VM. Enable test signing before installing. ```powershell # Enable test signing (requires reboot) bcdedit /set testsigning on # On VMs, may also need: bcdedit /set nointegritychecks on # Reboot, then run NtWarden as Administrator. # Switching to the Kernel Mode tab auto-installs and starts KWinSys. ``` Manual driver management: ```powershell # Install manually sc create KWinSys type= kernel binPath= "C:\path\to\KWinSys.sys" sc start KWinSys # Stop and remove sc stop KWinSys sc delete KWinSys ``` The NtWarden GUI also exposes driver management under the **Driver** menu. --- ## Remote Inspection (WinSysServer) Deploy to a target machine (typically a VM) and connect from NtWarden. ### Files to copy to target | File | Source Path | Purpose | |---|---|---| | `WinSysServer.exe` | `x64/Release/WinSysServer.exe` | Always required | | `KWinSys.sys` | `x64/Release/KWinSys/KWinSys.sys` | Kernel features only | ### Starting the server (on target, elevated) ```powershell # Auto-install driver + start server on default port 50002 WinSysServer.exe --install # Custom port WinSysServer.exe --install --port 9000 # If driver already installed manually: WinSysServer.exe WinSysServer.exe --port 9000 ``` ### Connecting from NtWarden (on host) 1. Launch NtWarden 2. Go to **Remote** menu 3. Enter target IP and port (default: `50002`) 4. Click **Connect** ### Protocol notes - Custom binary protocol over TCP - 12-byte header: `MessageType`, `DataSize`, `Status` - **No authentication** — use only in isolated lab/VM environments - User-mode data (processes, services, network) works without KWinSys on target - Kernel tabs require KWinSys loaded on the remote target --- ## WinSys Static Library — Key Usage Patterns WinSys is the core library consumed by both NtWarden and WinSysServer. Example integration patterns in C++: ### Process Enumeration ```cpp #include "WinSys/ProcessManager.h" // Enumerate all processes (user mode) auto& pm = WinSys::ProcessManager::Get(); pm.Update(); // Refresh snapshot for (auto& proc : pm.GetProcesses()) { printf("PID: %5u Name: %s\n", proc->Id, proc->GetImageName().c_str()); } ``` ### Service Enumeration ```cpp #include "WinSys/ServiceManager.h" WinSys::ServiceManager svcMgr; auto services = svcMgr.EnumServices(); for (auto& svc : services) { printf("Service: %-40s State: %u StartType: %u\n", svc.GetName().c_str(), svc.Status.dwCurrentState, svc.Config.dwStartType); } ``` ### Network Connections ```cpp #include "WinSys/NetworkManager.h" WinSys::NetworkManager netMgr; auto conns = netMgr.GetTcpConnections(); for (auto& conn : conns) { printf("PID: %u Local: %s:%u Remote: %s:%u State: %u\n", conn.ProcessId, conn.LocalAddress.c_str(), conn.LocalPort, conn.RemoteAddress.c_str(), conn.RemotePort, conn.State); } ``` ### Communicating with KWinSys Driver (IOCTL) ```cpp #include "WinSys/KernelInterface.h" // Open handle to driver device WinSys::KernelInterface ki; if (!ki.Open()) { fprintf(stderr, "Failed to open KWinSys device. Is driver loaded?\n"); return; } // Enumerate kernel modules auto modules = ki.EnumKernelModules(); for (auto& mod : modules) { printf("Base: %p Size: 0x%X Path: %s\n", mod.Base, mod.Size, mod.FullPath.c_str()); } // Read kernel callbacks auto callbacks = ki.EnumProcessCallbacks(); for (auto& cb : callbacks) { printf("Callback: %p Module: %s Suspicious: %d\n", cb.Address, cb.OwnerModule.c_str(), cb.IsSuspicious ? 1 : 0); } ``` ### Per-Process Security Analysis (Analyze Process) Accessible via right-click > **Analyze Process** in the GUI, or programmatically: ```cpp #include "WinSys/ProcessAnalyzer.h" DWORD targetPid = 1234; WinSys::ProcessAnalyzer analyzer(targetPid); auto result = analyzer.Analyze(); // Unbacked executable memory (shellcode indicator) for (auto& region : result.UnbackedRegions) { printf("Unbacked RX region: base=%p size=0x%zX\n", region.Base, region.Size); } // Hollowing detection if (result.HollowingDetected) { printf("Hollowing: PEB ImageBase=%p vs PE Header ImageBase=%p\n", result.PebImageBase, result.PeHeaderImageBase); } // Direct syscalls outside ntdll for (auto& sc : result.DirectSyscalls) { printf("Direct syscall at: %p in module: %s\n", sc.Address, sc.ModuleName.c_str()); } // Inline user hooks for (auto& hook : result.UserHooks) { printf("Hook in %s!%s at %p -> %p\n", hook.Module.c_str(), hook.Function.c_str(), hook.Address, hook.Target); } // Token info printf("Elevated: %d IntegrityLevel: %u\n", result.Token.IsElevated, result.Token.IntegrityLevel); ``` --- ## Key Features by Tab ### User Mode (no driver) | Tab | Capability | |---|---| | Processes | Tree view, handles, threads, memory regions, modules | | Performance | CPU/RAM/GPU/network graphs, overlay mode | | Services | Status, start type, binary path | | Network > Connections | TCP/UDP with owning PID | | Network > Root Certificates | Subject, issuer, thumbprint | | Network > NDIS | Adapter driver, MAC, speed, media type | | ETW | Active trace sessions and registered providers | | IPC | RPC endpoints and named pipes | | Object Manager | Kernel object namespace browser | | Registry | Key/value browser | | Logger | Kernel driver debug logs + GUI logs | ### Kernel Mode (requires KWinSys) | Tab | Capability | |---|---| | Process Objects | EPROCESS enumeration, hidden process detection | | Modules | Kernel drivers + LolDrivers check | | Callbacks | Process/thread/image/registry/object/power callbacks + integrity | | SSDT | Entries with owner and hook detection | | Kernel Pool | Big pool allocations and tag stats | | Memory R/W | Read/write kernel memory by address | | Timers | Per-CPU interrupt and DPC counters | | Filter | Minifilter drivers with altitude/instance | | Descriptor Tables | GDT/IDT entries | | IRP Dispatch | IRP dispatch table for any driver | | WFP | WFP callout drivers and filters | | DSE Status | Driver Signature Enforcement state | | CI Policy | Code Integrity policy and enforcement level | | Kernel Integrity | Verify kernel .text vs on-disk image | | Hypervisor Hooks | EPT hook detection via timing analysis | --- ## Common Patterns ### Check if driver is loaded before using kernel features ```cpp #include "WinSys/KernelInterface.h" WinSys::KernelInterface ki; bool driverAvailable = ki.Open(); if (driverAvailable) { // Use kernel-mode features auto ssdt = ki.GetSSDTEntries(); } else { // Fall back to user-mode only fprintf(stderr, "KWinSys not loaded — kernel features unavailable.\n"); } ``` ### Detect hidden processes (cross-reference EPROCESS list vs user-mode list) ```cpp WinSys::KernelInterface ki; ki.Open(); auto kernelProcs = ki.EnumProcessObjects(); // Via EPROCESS walk auto& pm = WinSys::ProcessManager::Get(); pm.Update(); auto userProcs = pm.GetProcesses(); // Build set of user-visible PIDs std::unordered_set<DWORD> visiblePids; for (auto& p : userProcs) visiblePids.insert(p->Id); // Find PIDs in kernel list but not user list for (auto& kp : kernelProcs) { if (visiblePids.find(kp.ProcessId) == visiblePids.end()) { printf("HIDDEN PROCESS: PID=%u Name=%s\n", kp.ProcessId, kp.ImageName.c_str()); } } ``` --- ## Troubleshooting ### NtWarden won't show kernel tabs - Ensure KWinSys.sys is in the same directory as NtWarden.exe (or `x64/Release/KWinSys/`) - Run NtWarden as Administrator - Confirm test signing is enabled: `bcdedit /enum | findstr testsigning` - Check **Logger** tab for driver load errors ### Driver fails to install ```powershell # Verify test signing is on bcdedit /enum | Select-String "testsigning" # Check for existing broken service entry sc query KWinSys sc delete KWinSys # if stuck, delete and retry # Some VMs also need: bcdedit /set nointegritychecks on # Then reboot ``` ### WinSysServer connection refused ```powershell # Verify server is running on target netstat -ano | findstr 50002 # Check Windows Firewall on target netsh advfirewall firewall add rule name="WinSysServer" ` dir=in action=allow protocol=TCP localport=50002 ``` ### Capstone not found (user hooks tab shows no data) - User hook detection with disassembly requires Capstone - Build WinSys with Capstone linked, or the hook scanner will report bytes without disassembly ### Performance overlay not visible - Launch NtWarden, go to **Performance** tab - Enable overlay mode — it renders over other windows using DirectX 11 transparency ### Build errors — missing WDK - KWinSys requires the Windows Driver Kit - If you only need user-mode features, exclude KWinSys project from build in Visual Studio (right-click project > **Unload Project**) --- ## Tested Windows Versions - Windows 11 23H2 (Build 22631.6199) - Windows 10 22H2 (Build 19045.2006) - Windows 10 1703 (Build 15063.13) --- ## References - [zodiacon](https://github.com/zodiacon) — Primary inspiration - [WinArk](https://github.com/BeneficialCode/WinArk) — Kernel-mode feature reference - [LolDrivers](https://www.loldrivers.io/) — Vulnerable driver database used in Modules tab